https://vulnogram.org/ Most recent CVEs assigned by Mozilla Corporation (mozilla). https://vulnogram.org/seaview/icons/mozilla.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-113869 https://vulnogram.org/CVE-2026-113869 When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder wh… Medium Tue, 20 Oct 2026 19:14:55 GMT https://vulnogram.org/CVE-2026-113868 https://vulnogram.org/CVE-2026-113868 When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM res… Medium Tue, 20 Oct 2026 19:14:55 GMT https://vulnogram.org/CVE-2026-113867 https://vulnogram.org/CVE-2026-113867 Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitra… Tue, 20 Oct 2026 19:14:55 GMT https://vulnogram.org/CVE-2026-113866 https://vulnogram.org/CVE-2026-113866 When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker t… Medium Network Exploitable Tue, 20 Oct 2026 19:14:54 GMT https://vulnogram.org/CVE-2026-113401 https://vulnogram.org/CVE-2026-113401 Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. Medium Network Exploitable Tue, 20 Oct 2026 12:58:16 GMT https://vulnogram.org/CVE-2026-113400 https://vulnogram.org/CVE-2026-113400 Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. Medium Network Exploitable Tue, 20 Oct 2026 12:58:15 GMT https://vulnogram.org/CVE-2026-113399 https://vulnogram.org/CVE-2026-113399 Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. Tue, 20 Oct 2026 12:58:14 GMT https://vulnogram.org/CVE-2026-113470 https://vulnogram.org/CVE-2026-113470 Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the comp… Medium Network Exploitable Tue, 20 Oct 2026 12:58:14 GMT https://vulnogram.org/CVE-2026-110249 https://vulnogram.org/CVE-2026-110249 A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in… High Tue, 13 Oct 2026 18:08:38 GMT https://vulnogram.org/CVE-2026-110247 https://vulnogram.org/CVE-2026-110247 Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent mem… High Tue, 13 Oct 2026 18:08:37 GMT https://vulnogram.org/CVE-2026-109783 https://vulnogram.org/CVE-2026-109783 Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5. Tue, 13 Oct 2026 12:29:36 GMT https://vulnogram.org/CVE-2026-109782 https://vulnogram.org/CVE-2026-109782 Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5. Tue, 13 Oct 2026 12:29:36 GMT https://vulnogram.org/CVE-2026-109781 https://vulnogram.org/CVE-2026-109781 Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Medium Network Exploitable Tue, 13 Oct 2026 12:29:35 GMT https://vulnogram.org/CVE-2026-109780 https://vulnogram.org/CVE-2026-109780 Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Tue, 13 Oct 2026 12:29:35 GMT https://vulnogram.org/CVE-2026-109779 https://vulnogram.org/CVE-2026-109779 Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Medium Network Exploitable Tue, 13 Oct 2026 12:29:35 GMT https://vulnogram.org/CVE-2026-109778 https://vulnogram.org/CVE-2026-109778 Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High Network Exploitable Tue, 13 Oct 2026 12:29:35 GMT https://vulnogram.org/CVE-2026-109777 https://vulnogram.org/CVE-2026-109777 Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Medium Network Exploitable Tue, 13 Oct 2026 12:29:34 GMT https://vulnogram.org/CVE-2026-109776 https://vulnogram.org/CVE-2026-109776 Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Medium Network Exploitable Tue, 13 Oct 2026 12:29:34 GMT https://vulnogram.org/CVE-2026-109775 https://vulnogram.org/CVE-2026-109775 Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Medium Network Exploitable Tue, 13 Oct 2026 12:29:34 GMT https://vulnogram.org/CVE-2026-109774 https://vulnogram.org/CVE-2026-109774 Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Tue, 13 Oct 2026 12:29:34 GMT https://vulnogram.org/CVE-2026-109773 https://vulnogram.org/CVE-2026-109773 Denial-of-service in the Sync component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Medium Network Exploitable Tue, 13 Oct 2026 12:29:34 GMT https://vulnogram.org/CVE-2026-109772 https://vulnogram.org/CVE-2026-109772 Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Tue, 13 Oct 2026 12:29:33 GMT https://vulnogram.org/CVE-2026-109771 https://vulnogram.org/CVE-2026-109771 Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Medium Network Exploitable Tue, 13 Oct 2026 12:29:33 GMT https://vulnogram.org/CVE-2026-109770 https://vulnogram.org/CVE-2026-109770 Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Medium Network Exploitable Tue, 13 Oct 2026 12:29:33 GMT https://vulnogram.org/CVE-2026-109769 https://vulnogram.org/CVE-2026-109769 Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Medium Network Exploitable Tue, 13 Oct 2026 12:29:33 GMT https://vulnogram.org/CVE-2026-109768 https://vulnogram.org/CVE-2026-109768 Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Medium Network Exploitable Tue, 13 Oct 2026 12:29:33 GMT https://vulnogram.org/CVE-2026-109767 https://vulnogram.org/CVE-2026-109767 Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Medium Network Exploitable Tue, 13 Oct 2026 12:29:32 GMT https://vulnogram.org/CVE-2026-109766 https://vulnogram.org/CVE-2026-109766 Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High Network Exploitable Tue, 13 Oct 2026 12:29:32 GMT https://vulnogram.org/CVE-2026-109765 https://vulnogram.org/CVE-2026-109765 Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Medium Network Exploitable Tue, 13 Oct 2026 12:29:32 GMT https://vulnogram.org/CVE-2026-109764 https://vulnogram.org/CVE-2026-109764 Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Medium Network Exploitable Tue, 13 Oct 2026 12:29:32 GMT https://vulnogram.org/CVE-2026-109763 https://vulnogram.org/CVE-2026-109763 Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Tue, 13 Oct 2026 12:29:31 GMT https://vulnogram.org/CVE-2026-109762 https://vulnogram.org/CVE-2026-109762 Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High Network Exploitable Tue, 13 Oct 2026 12:29:31 GMT https://vulnogram.org/CVE-2026-109761 https://vulnogram.org/CVE-2026-109761 Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Medium Network Exploitable Tue, 13 Oct 2026 12:29:31 GMT https://vulnogram.org/CVE-2026-109760 https://vulnogram.org/CVE-2026-109760 Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High Network Exploitable Tue, 13 Oct 2026 12:29:31 GMT https://vulnogram.org/CVE-2026-109759 https://vulnogram.org/CVE-2026-109759 Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High Network Exploitable Tue, 13 Oct 2026 12:29:30 GMT https://vulnogram.org/CVE-2026-109757 https://vulnogram.org/CVE-2026-109757 Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High Network Exploitable Tue, 13 Oct 2026 12:29:30 GMT https://vulnogram.org/CVE-2026-109756 https://vulnogram.org/CVE-2026-109756 Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High Network Exploitable Tue, 13 Oct 2026 12:29:30 GMT https://vulnogram.org/CVE-2026-109755 https://vulnogram.org/CVE-2026-109755 Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Critical Network Exploitable Tue, 13 Oct 2026 12:29:30 GMT https://vulnogram.org/CVE-2026-109754 https://vulnogram.org/CVE-2026-109754 Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High Network Exploitable Tue, 13 Oct 2026 12:29:29 GMT https://vulnogram.org/CVE-2026-109752 https://vulnogram.org/CVE-2026-109752 Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Medium Network Exploitable Tue, 13 Oct 2026 12:29:29 GMT https://vulnogram.org/CVE-2026-109751 https://vulnogram.org/CVE-2026-109751 Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Medium Network Exploitable Tue, 13 Oct 2026 12:29:29 GMT https://vulnogram.org/CVE-2026-109750 https://vulnogram.org/CVE-2026-109750 Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Critical Network Exploitable Tue, 13 Oct 2026 12:29:28 GMT https://vulnogram.org/CVE-2026-109749 https://vulnogram.org/CVE-2026-109749 Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Medium Network Exploitable Tue, 13 Oct 2026 12:29:28 GMT https://vulnogram.org/CVE-2026-109748 https://vulnogram.org/CVE-2026-109748 Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. Medium Network Exploitable Tue, 13 Oct 2026 12:29:28 GMT https://vulnogram.org/CVE-2026-109747 https://vulnogram.org/CVE-2026-109747 Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. High Network Exploitable Tue, 13 Oct 2026 12:29:27 GMT https://vulnogram.org/CVE-2026-109746 https://vulnogram.org/CVE-2026-109746 Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. High Network Exploitable Tue, 13 Oct 2026 12:29:27 GMT https://vulnogram.org/CVE-2026-109745 https://vulnogram.org/CVE-2026-109745 Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Critical Network Exploitable Tue, 13 Oct 2026 12:29:27 GMT https://vulnogram.org/CVE-2026-109744 https://vulnogram.org/CVE-2026-109744 Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High Network Exploitable Tue, 13 Oct 2026 12:29:27 GMT https://vulnogram.org/CVE-2026-109743 https://vulnogram.org/CVE-2026-109743 Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. High Tue, 13 Oct 2026 12:29:26 GMT https://vulnogram.org/CVE-2026-109742 https://vulnogram.org/CVE-2026-109742 Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. Medium Network Exploitable Tue, 13 Oct 2026 12:29:26 GMT